Mobile app version of vmapp.org
Login or Join
Steve110

: My wordpress site blacklisted as malware by Google Two years ago I've built a small Wordpress site for a friend of mine, and some weeks ago I got a warning mail from my ISP, about a worldwide

@Steve110

Posted in: #Cpanel #Malware

Two years ago I've built a small Wordpress site for a friend of mine, and some weeks ago I got a warning mail from my ISP, about a worldwide attack to Joomla, Wordpress... (well, more or less, it was italian, of course). I had no idea what to do, and nothing seemed to happen. Two days ago, browsing to that site I got a message from my browser (Firefox), about possible malware being detected on my site.

I think I've found something to clear, namely a .htaccess under /public_html directory, containing only:

RewriteBase /
RewriteEngine on


Well, I can browse that and then I can delete it. But there is also a skript.php that I can't inspect - and then neither delete - insufficient permission.

EDIT: Now I found also that in wp-admin there is an images.php that also I can't inspect, and an .htaccess containing the redirection to the site Google was advising against.

I'm using FTP now to check the site, because cpanel (accessed of course with the browser) also give the warning. It's safe to use cpanel? I can't see other way to clean up my site.

10.04% popularity Vote Up Vote Down


Login to follow query

More posts by @Steve110

2 Comments

Sorted by latest first Latest Oldest Best

 

@Sent6035632

Probably there is also some security issue with the Wordpress setup, being it two years old maybe it's time to apply security patches.
if you don't want (or can't) rebuild the server from scratch, I sould suggest to:


check the date/time of creation of the file images.php as this is probably when the whole site got corrupted
find all .php files created/modified that day at that time
restore/delete all those files
browse your site with malware detection antivirus (kaspersky has good engine for trojans)
if virus/trojan is detected find the virus signature: really not that difficult, since they're usually javascript based, so with Firebug you can track them easily
check for that signature in filesystem and database
delete/restore records/files affected by that virus


If you have got a linux server the thing seems more difficult than it actually is, done this work lately, and a whole Wordpress site was cleaned in a couple of hours.

10% popularity Vote Up Vote Down


 

@Connie744

If you can't access to some files or folders, I would recommend you to change the file permissions.

When your site is blacklisted/removed from search results, Google recommends webmasters to take their site down as soon as possible, to contact their web hoster and then to change all passwords for all users and all accounts. support.google.com/webmasters/bin/answer.py?hl=en&answer=163634
The last step is to ask Google to review your site:


On the Webmaster Tools Home page
Select the site you want.
Click Health, and then click Malware.
Click Request a review.

10% popularity Vote Up Vote Down


Back to top | Use Dark Theme